CVE-2020-23226

NameCVE-2020-23226
DescriptionMultiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2965-1, DLA-3252-1, ELA-588-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cacti (PTS)jessie, jessie (lts)0.8.8b+dfsg-8+deb8u10fixed
stretch (security), stretch (lts), stretch0.8.8h+ds1-10+deb9u2fixed
buster (security), buster, buster (lts)1.2.2+ds1-2+deb10u6fixed
bullseye1.2.16+ds1-2+deb11u3fixed
bullseye (security)1.2.16+ds1-2+deb11u4fixed
bookworm1.2.24+ds1-1+deb12u4fixed
bookworm (security)1.2.24+ds1-1+deb12u2fixed
sid, trixie1.2.28+ds1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cactisourcejessie0.8.8b+dfsg-8+deb8u10ELA-588-1
cactisourcestretch0.8.8h+ds1-10+deb9u2DLA-2965-1
cactisourcebuster1.2.2+ds1-2+deb10u5DLA-3252-1
cactisource(unstable)1.2.13+ds1-1

Notes

https://github.com/Cacti/cacti/issues/3549
https://github.com/Cacti/cacti/commit/8d5fbc48debddc91a66b5aed877060566c6b6232 (1.2.13)
https://github.com/Cacti/cacti/commit/74c011ba8635902713c530ded90bc0a045ca461d (1.2.13)
https://github.com/Cacti/cacti/commit/5e4c77e908d6ff895a97fb29e1b582160f8d4165 (1.2.13)
https://github.com/Cacti/cacti/commit/798f499eacc6b90e9e0e6a38db15edf564e3729f (1.2.13)
https://github.com/Cacti/cacti/commit/dc35a79b15eeb68a46205c7b06d812953fbbf94d (1.2.13)
https://github.com/Cacti/cacti/commit/72baf7b63bca7b1ee26f37f99be406ea20debf71 (1.2.13)
https://github.com/Cacti/cacti/commit/de5e60c97b55b17d8d9e7d9782426ac6e941500d (1.2.13)
https://github.com/Cacti/cacti/commit/a3233a1b3c3c25a325d334c69b4c94d56473cceb (1.2.13)
https://github.com/Cacti/cacti/commit/80ec47b08a06dddc4f2135562d29f2c619cc264f (1.2.13)

Search for package or bug name: Reporting problems